From: pietrofio on
Hello,
i have a web server (win 2k3 sp1 with Ms sql server 2000). In the main
application pool the w3wp.exe process requires 60% of cpu utilization and
600MB of ram allocated.
I host seven asp + sql portals with thousand visits per day.There is also a
CMS in asp.net and many smaller sites. Sometimes the cpu (2 intel xeon 3 ghz
and 4GB ram) are over 95% of utilization and server is very slow so I must
reboot it.
I fear that there is a denial of service attack or that cpu enter in loop
for some reasons.
This is the output of iistate:

Opened log file 'C:\iisstate\output\IISState-2144.log'

***********************
Starting new log output
IISState version 3.3.1

Wed Mar 21 16:37:20 2007

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 2144

Note: Thread times are formatted as HH:MM:SS.ms

***********************
Thread ID: 0
System Thread ID: 864
Kernel Time: 0:0:0.46
User Time: 0:0:0.31
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0006fc08 7c822124 ntdll!KiFastSystemCallRet
01 0006fc0c 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0006fc7c 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
04 0006fca0 5a366e63 w3dt!WP_CONTEXT::RunMainThreadLoop+0x10
05 0006fca8 5a3af41d w3dt!UlAtqStartListen+0x2d
06 0006fcb8 5a3bc259 w3core!W3_SERVER::StartListen+0xbd
07 0006ff0c 0100187c w3core!UlW3Start+0x26e
08 0006ff44 01001a23 w3wp!wmain+0x22a
09 0006ffc0 77e523e5 w3wp!wmainCRTStartup+0x12b
0a 0006fff0 00000000 kernel32!BaseProcessStart+0x23

Thread ID: 1
System Thread ID: 86c
Kernel Time: 0:0:0.312
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 009eff9c 7c821364 ntdll!KiFastSystemCallRet
01 009effa0 7c81fe26 ntdll!NtDelayExecution+0xc
02 009effb8 77e6608b ntdll!RtlpTimerThread+0x47
03 009effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 2
System Thread ID: 870
Kernel Time: 0:0:0.31
User Time: 0:0:0.31
Thread Type: Other
# ChildEBP RetAddr
00 00a2ff70 7c821bf4 ntdll!KiFastSystemCallRet
01 00a2ff74 7c83ad75 ntdll!NtRemoveIoCompletion+0xc
02 00a2ffb8 77e6608b ntdll!RtlpWorkerThread+0x3d
03 00a2ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 3
System Thread ID: 8a4
Kernel Time: 0:0:4.812
User Time: 0:0:5.437
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00c8ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00c8ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00c8ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00c8ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00c8ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00c8ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00c8ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 4
System Thread ID: 8a8
Kernel Time: 0:0:6.0
User Time: 0:0:6.265
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00ccff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00ccff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00ccff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00ccff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00ccffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00ccffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00ccffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 5
System Thread ID: 8ac
Kernel Time: 0:0:2.750
User Time: 0:0:3.453
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d0ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d0ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00d0ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d0ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d0ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d0ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d0ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 6
System Thread ID: 8b0
Kernel Time: 0:0:4.859
User Time: 0:0:5.656
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00d4ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 00d4ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 00d4ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 00d4ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 00d4ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 00d4ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 00d4ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 7
System Thread ID: 8b4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 00e0fcec 7c822114 ntdll!KiFastSystemCallRet
01 00e0fcf0 7c83acfd ntdll!NtWaitForMultipleObjects+0xc
02 00e0ffb8 77e6608b ntdll!RtlpWaitThread+0x161
03 00e0ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 8
System Thread ID: 8b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 017efa84 7c822124 ntdll!KiFastSystemCallRet
01 017efa88 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 017efaf8 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 017efb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
04 017effb8 77e6608b w3core!HTTP_COMPRESSION::CompressionThread+0x126
05 017effec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 9
System Thread ID: 8c0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0186ff8c 7c821364 ntdll!KiFastSystemCallRet
01 0186ff90 7c815267 ntdll!NtDelayExecution+0xc
02 0186ffb8 77e6608b ntdll!RtlpIOWorkerThread+0x3f
03 0186ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 10
System Thread ID: 8cc
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 0254ff0c 7c822124 ntdll!KiFastSystemCallRet
01 0254ff10 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0254ff80 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0254ff94 709fc91b kernel32!WaitForSingleObject+0x12
04 0254ffb4 709fc8f3 asp!CApplnCleanupMgr::ApplnCleanupDoWork+0x1e
05 0254ffb8 77e6608b asp!CApplnCleanupMgr::ApplnCleanupThread+0xa
06 0254ffec 00000000 kernel32!BaseThreadStart+0x34


Thread ID: 11
System Thread ID: 8d0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 0280fe1c 7c822114 ntdll!KiFastSystemCallRet
01 0280fe20 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 0280fec8 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 0280ff24 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 0280ff40 709fbcbe USER32!MsgWaitForMultipleObjects+0x1f
05 0280ff84 77bcb530 asp!CMTACallbackThread::Thread+0x4f
06 0280ffb8 77e6608b msvcrt!_endthreadex+0xa3
07 0280ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 12
System Thread ID: 8e4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: ASP
Executing Page: Unable to locate ASP page

# ChildEBP RetAddr
00 0289fef4 7c822124 ntdll!KiFastSystemCallRet
01 0289fef8 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0289ff68 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0289ff7c 709fe9b7 kernel32!WaitForSingleObject+0x12
04 0289ffb8 77e6608b asp!CViperReqManager::WatchThread+0x68
05 0289ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 13
System Thread ID: 8e8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 028ffee8 7c822124 ntdll!KiFastSystemCallRet
01 028ffeec 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 028fff5c 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 028fff70 75bd4bd0 kernel32!WaitForSingleObject+0x12
04 028fff84 77bcb530 comsvcs!CSTAThreadPool::LoadBalanceThreadControlLoop+0x29
05 028fffb8 77e6608b msvcrt!_endthreadex+0xa3
06 028fffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 14
System Thread ID: 8ec
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0293fee0 7c822124 ntdll!KiFastSystemCallRet
01 0293fee4 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0293ff54 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0293ff68 75bd464d kernel32!WaitForSingleObject+0x12
04 0293ff84 77bcb530 comsvcs!CSTAThreadPool::KillThreadControlLoop+0x25
05 0293ffb8 77e6608b msvcrt!_endthreadex+0xa3
06 0293ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 15
System Thread ID: 8f0
Kernel Time: 0:0:10.671
User Time: 0:0:14.656
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0297fdcc 7c822114 ntdll!KiFastSystemCallRet
01 0297fdd0 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 0297fe78 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 0297fed4 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 0297fef0 75bd86c6 USER32!MsgWaitForMultipleObjects+0x1f
05 0297ff84 77bcb530 comsvcs!CSTAThread::WorkerLoop+0x1e5
06 0297ffb8 77e6608b msvcrt!_endthreadex+0xa3
07 0297ffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 16
System Thread ID: 8f4
Kernel Time: 0:0:12.609
User Time: 0:0:16.343
Thread Status: Thread is in a WAIT state.
Thread Type: SQL Query. Possible ASP page
Executing Page: ??-----

# ChildEBP RetAddr
00 029bdf8c 7c822124 ntdll!KiFastSystemCallRet
01 029bdf90 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 029be000 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 029be014 74cd20fe kernel32!WaitForSingleObject+0x12
04 029be040 6d56db96 DBmsLPCn!ConnectionRead+0xbb
05 029be060 6d56871b DBNETLIB!WrapperRead+0x2c
06 029be0b8 4ca537cd DBNETLIB!ConnectionRead+0x519
07 029be108 4ca5aeb0 SQLSRV32!getbytes+0x1fa
08 029be7c4 4ca5c3f8 SQLSRV32!ProcessTDSStream+0x204
09 029be82c 4bf76b1f SQLSRV32!SQLExecDirectW+0xe46
0a 029be84c 4bf76bf3 ODBC32!SQLExecute+0x26f
0b 029be86c 4bfb87e3 ODBC32!SQLExecDirectW+0x3b
0c 029be894 4bfb6ee9 msdasql!CImpICommandText::ExecuteHelper+0xfa
0d 029be96c 4bbe952e msdasql!CImpICommandText::Execute+0x673
0e 029be9ac 4bc0c9db msado15!CConnection::Execute+0x9d
0f 029beb7c 4bbe9388 msado15!_ExecuteAsync+0x19f
10 029beb90 4bbe90e0 msado15!ExecuteAsync+0x23
11 029bec78 4bbe9303 msado15!CQuery::Execute+0xa5e
12 029bece4 4bbe6128 msado15!CCommand::_Execute+0x153
13 029bed78 4bbe6400 msado15!CRecordset::_Open+0x30f
14 029beef0 4bbf4dcc msado15!CRecordset::Open+0x5dc
15 029bf364 73469f71 msado15!CRecordset::Invoke+0x1351
16 029bf3b8 73468f37 VBScript!CatchIDispatchInvoke+0x46
17 029bf3f8 73468ea6 VBScript!IDispatchInvoke2+0xaf
18 029bf434 73469000 VBScript!IDispatchInvoke+0x59
19 029bf548 73467bb6 VBScript!InvokeDispatch+0x13a
1a 029bf56c 73467e29 VBScript!InvokeByName+0x42
1b 029bf848 73464940 VBScript!CScriptRuntime::Run+0x2625
1c 029bf940 73464cd2 VBScript!CScriptEntryPoint::Call+0x5c
1d 029bf998 73465522 VBScript!CSession::Execute+0xb4
1e 029bf9e8 7346189b VBScript!COleScript::ExecutePendingScripts+0x13e
1f 029bfa04 709e2f5a VBScript!COleScript::SetScriptState+0x150
20 029bfa30 709e2f1a asp!CActiveScriptEngine::TryCall+0x19
21 029bfa6c 709e2e50 asp!CActiveScriptEngine::Call+0x31
22 029bfa88 709e2d54 asp!CallScriptFunctionOfEngine+0x5b
23 029bfadc 709e2c7f asp!ExecuteRequest+0x17e
24 029bfb44 709e2a4d asp!Execute+0x249
25 029bfb98 709e271a asp!CHitObj::ViperAsyncCallback+0x3e8
26 029bfbb4 75bd72a5 asp!CViperAsyncRequest::OnCall+0x92
27 029bfbd0 7770f0eb comsvcs!CSTAActivityWork::STAActivityWorkHelper+0x32
28 029bfc1c 7770fb38 ole32!EnterForCallback+0xc4
29 029bfd7c 77710042 ole32!SwitchForCallback+0x1a3
2a 029bfda8 77694098 ole32!PerformCallback+0x54
2b 029bfe40 777127fd ole32!CObjectContext::InternalContextCallback+0x159
2c 029bfe60 75bd7649 ole32!CObjectContext::DoCallback+0x1c
2d 029bfecc 75bd79a5 comsvcs!CSTAActivityWork::DoWork+0x12d
2e 029bfee4 75bd833e comsvcs!CSTAThread::DoWork+0x18
2f 029bff04 75bd878a comsvcs!CSTAThread::ProcessQueueWork+0x37
30 029bff84 77bcb530 comsvcs!CSTAThread::WorkerLoop+0x17c
31 029bffb8 77e6608b msvcrt!_endthreadex+0xa3

Thread ID: 17
System Thread ID: 8f8
Kernel Time: 0:0:15.968
User Time: 0:0:20.796
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 029ffdcc 7c822114 ntdll!KiFastSystemCallRet
01 029ffdd0 77e67143 ntdll!NtWaitForMultipleObjects+0xc
02 029ffe78 7739cd08 kernel32!WaitForMultipleObjectsEx+0x11a
03 029ffed4 7738e381 USER32!RealMsgWaitForMultipleObjectsEx+0x141
04 029ffef0 75bd86c6 USER32!MsgWaitForMultipleObjects+0x1f
05 029fff84 77bcb530 comsvcs!CSTAThread::WorkerLoop+0x1e5
06 029fffb8 77e6608b msvcrt!_endthreadex+0xa3
07 029fffec 00000000 kernel32!BaseThreadStart+0x34


Thread ID: 18
System Thread ID: 8fc
Kernel Time: 0:0:11.812
User Time: 0:0:17.218
Thread Status: Thread is in a WAIT state.
Thread Type: SQL Query. Possible ASP page
Executing Page: ??-----

# ChildEBP RetAddr
00 02a3df8c 7c822124 ntdll!KiFastSystemCallRet
01 02a3df90 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 02a3e000 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 02a3e014 74cd20fe kernel32!WaitForSingleObject+0x12
04 02a3e040 6d56db96 DBmsLPCn!ConnectionRead+0xbb
05 02a3e060 6d56871b DBNETLIB!WrapperRead+0x2c
06 02a3e0b8 4ca537cd DBNETLIB!ConnectionRead+0x519
07 02a3e108 4ca5aeb0 SQLSRV32!getbytes+0x1fa
08 02a3e7c4 4ca5c3f8 SQLSRV32!ProcessTDSStream+0x204
09 02a3e82c 4bf76b1f SQLSRV32!SQLExecDirectW+0xe46
0a 02a3e84c 4bf76bf3 ODBC32!SQLExecute+0x26f
0b 02a3e86c 4bfb87e3 ODBC32!SQLExecDirectW+0x3b
0c 02a3e894 4bfb6ee9 msdasql!CImpICommandText::ExecuteHelper+0xfa
0d 02a3e96c 4bbe952e msdasql!CImpICommandText::Execute+0x673
0e 02a3e9ac 4bc0c9db msado15!CConnection::Execute+0x9d
0f 02a3eb7c 4bbe9388 msado15!_ExecuteAsync+0x19f
10 02a3eb90 4bbe90e0 msado15!ExecuteAsync+0x23
11 02a3ec78 4bbe9303 msado15!CQuery::Execute+0xa5e
12 02a3ece4 4bbe6128 msado15!CCommand::_Execute+0x153
13 02a3ed78 4bbe6400 msado15!CRecordset::_Open+0x30f
14 02a3eef0 4bbf4dcc msado15!CRecordset::Open+0x5dc
15 02a3f364 73469f71 msado15!CRecordset::Invoke+0x1351
16 02a3f3b8 73468f37 VBScript!CatchIDispatchInvoke+0x46
17 02a3f3f8 73468ea6 VBScript!IDispatchInvoke2+0xaf
18 02a3f434 73469000 VBScript!IDispatchInvoke+0x59
19 02a3f548 73467bb6 VBScript!InvokeDispatch+0x13a
1a 02a3f56c 73467e29 VBScript!InvokeByName+0x42
1b 02a3f848 73464940 VBScript!CScriptRuntime::Run+0x2625
1c 02a3f940 73464cd2 VBScript!CScriptEntryPoint::Call+0x5c
1d 02a3f998 73465522 VBScript!CSession::Execute+0xb4
1e 02a3f9e8 7346189b VBScript!COleScript::ExecutePendingScripts+0x13e
1f 02a3fa04 709e2f5a VBScript!COleScript::SetScriptState+0x150
20 02a3fa30 709e2f1a asp!CActiveScriptEngine::TryCall+0x19
21 02a3fa6c 709e2e50 asp!CActiveScriptEngine::Call+0x31
22 02a3fa88 709e2d54 asp!CallScriptFunctionOfEngine+0x5b
23 02a3fadc 709e2c7f asp!ExecuteRequest+0x17e
24 02a3fb44 709e2a4d asp!Execute+0x249
25 02a3fb98 709e271a asp!CHitObj::ViperAsyncCallback+0x3e8
26 02a3fbb4 75bd72a5 asp!CViperAsyncRequest::OnCall+0x92
27 02a3fbd0 7770f0eb comsvcs!CSTAActivityWork::STAActivityWorkHelper+0x32
28 02a3fc1c 7770fb38 ole32!EnterForCallback+0xc4
29 02a3fd7c 77710042 ole32!SwitchForCallback+0x1a3
2a 02a3fda8 77694098 ole32!PerformCallback+0x54
2b 02a3fe40 777127fd ole32!CObjectContext::InternalContextCallback+0x159
2c 02a3fe60 75bd7649 ole32!CObjectContext::DoCallback+0x1c
2d 02a3fecc 75bd79a5 comsvcs!CSTAActivityWork::DoWork+0x12d
2e 02a3fee4 75bd833e comsvcs!CSTAThread::DoWork+0x18
2f 02a3ff04 75bd878a comsvcs!CSTAThread::ProcessQueueWork+0x37
30 02a3ff84 77bcb530 comsvcs!CSTAThread::WorkerLoop+0x17c
31 02a3ffb8 77e6608b msvcrt!_endthreadex+0xa3

Thread ID: 19
System Thread ID: 97c
Kernel Time: 0:0:0.46
User Time: 0:0:0.312
Thread Status: Thread is in a WAIT state.
Thread Type: Idle ASP thread
# ChildEBP RetAddr
00 0340fd00 7c822124 ntdll!KiFastSystemCallRet
01 0340fd04 77e6bad8 ntdll!NtWaitForSingleObject+0xc
02 0340fd74 77e6ba42 kernel32!WaitForSingleObjectEx+0xac
03 0340fd88 75bb22b9 kernel32!WaitForSingleObject+0x12
04 0340ffb8 77e6608b comsvcs!PingThread+0xf6
05 0340ffec 00000000 kernel32!BaseThreadStart+0x34


Thread ID: 20
System Thread ID: 988
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 035cff88 7c822114 ntdll!KiFastSystemCallRet
01 035cff8c 71c6df19 ntdll!NtWaitForMultipleObjects+0xc
02 035cffb8 77e6608b NETAPI32!NetbiosWaiter+0x73
03 035cffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 21
System Thread ID: 9a4
Kernel Time: 0:0:5.703
User Time: 0:0:7.437
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 02c5ff24 7c821bf4 ntdll!KiFastSystemCallRet
01 02c5ff28 77e66142 ntdll!NtRemoveIoCompletion+0xc
02 02c5ff54 5a30249e kernel32!GetQueuedCompletionStatus+0x29
03 02c5ff8c 5a3026bc W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x33
04 02c5ffa0 5a301db9 W3TP!THREAD_POOL_DATA::ThreadPoolThread+0x24
05 02c5ffb8 77e6608b W3TP!THREAD_MANAGER::ThreadManagerThread+0x39
06 02c5ffec 00000000 kernel32!BaseThreadStart+0x34


Thread ID: 22
System Thread ID: bb8
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 060dfe50 7c821364 ntdll!KiFastSystemCallRet
01 060dfe54 77e41ea7 ntdll!NtDelayExecution+0xc
02 060dfebc 77e424c1 kernel32!SleepEx+0x68
03 060dfecc 791bf4f9 kernel32!Sleep+0xf
04 060dffb8 77e6608b mscorsvr+0xf4f9
05 060dffec 00000000 kernel32!BaseThreadStart+0x34

Thread ID: 23
System Thread ID: bbc
Kernel Time: 0:2:45.953
User Time: 0:7:6.203
*** WARNING: Unable to verify checksum for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_34525d09\mscorlib.dll
*** ERROR: Module load completed but symbols could not be loaded for
c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_34525d09\mscorlib.dll
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
succeeded
Loaded Son of Strike data table version 5 from
"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll"
Thread 23
ESP EIP
0611f7c0 7c82ed54 [FRAME: NDirectMethodFrameStandalone] [DEFAULT] Boolean
Microsoft.Win32.Win32Native.GetFileAttributesEx(String,I4,ByRef ValueClass
WIN32_FILE_ATTRIBUTE_DATA)
0611f7d4 799dc8b4 [DEFAULT] I4
System.IO.File.FillAttributeInfo(String,ByRef ValueClass
WIN32_FILE_ATTRIBUTE_DATA,Boolean)
0611f830 799dd087 [DEFAULT] Boolean
System.IO.Directory.InternalExists(String)
0611f860 799dd01a [DEFAULT] Boolean System.IO.Directory.Exists(String)
0611f89c 05cf69b7 [DEFAULT] Boolean
System.Web.Util.FileUtil.DirectoryExists(String)
0611f8c4 05cf6974 [DEFAULT] Boolean
System.Web.Configuration.HttpConfigurationSystem.IsDirectory(String)
0611f8c8 06b6ad89 [DEFAULT] [hasThis] Class
System.Web.Configuration.HttpConfigurationRecord
System.Web.Configuration.HttpConfigurationSystem.ComposeConfig(String,Class
System.Web.IHttpMapPath)
c0000005 Exception in
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\sos.dll.ClrStack debugger
extension.
PC: 6028d1b4 VA: 00145000 R/W: 0 Parameter: 0001003f


Begin System Thread Information

# ChildEBP RetAddr
00 0611f70c 7c821954 ntdll!KiFastSystemCallRet
01 0611f710 77e67c5f ntdll!NtQueryFullAttributesFile+0xc
02 0611f794 0628aa0c kernel32!GetFileAttributesExW+0x84
WARNING: Frame IP not in any known module. Following frames may be wrong.
03 0611f824 799dd087 0x628aa0c
04 0611f894 05cf69b7 mscorlib_79990000+0x4d087
05 0611f8bc 05cf6974 0x5cf69b7
06 00000000 00000000 0x5cf6974




Thread ID: 24
System Thread ID: bc0
Kernel Time: 0:3:0.625
User Time: 0:7:28.671
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
Thread 24
ESP EIP
0615f740 7c82ed54 [FRAME: NDirectMethodFrameStandalone] [DEFAULT] Boolean
Microsoft.Win32.Win32Native.GetFileAttributesEx(String,I4,ByRef ValueClass
WIN32_FILE_ATTRIBUTE_DATA)
0615f754 799dc8b4 [DEFAULT] I4
System.IO.File.FillAttributeInfo(String,ByRef ValueClass
WIN32_FILE_ATTRIBUTE_DATA,Boolean)
0615f7b0 799dd087 [DEFAULT] Boolean
System.IO.Directory.InternalExists(String)
0615f7e0 799dd01a [DEFAULT] Boolean System.IO.Directory.Exists(String)
0615f81c 05cf69b7 [DEFAULT] Boolean
System.Web.Util.FileUtil.DirectoryExists(String)
0615f844 05cf6974 [DEFAULT] Boolean
System.Web.Configuration.HttpConfigurationSystem.IsDirectory(String)
0615f848 06b6ad89 [DEFAULT] [hasThis] Class
System.Web.Configuration.HttpConfigurationRecord
System.Web.Configuration.HttpConfigurationSystem.ComposeConfig(String,Class
System.Web.IHttpMapPath)
c0000005 Exception in
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\sos.dll.ClrStack debugger
extension.
PC: 6028d1b4 VA: 00145000 R/W: 0 Parameter: 0001003f


Begin System Thread Information

# ChildEBP RetAddr
00 0615f68c 7c821954 ntdll!KiFastSystemCallRet
01 0615f690 77e67c5f ntdll!NtQueryFullAttributesFile+0xc
02 0615f714 0628aa0c kernel32!GetFileAttributesExW+0x84
WARNING: Frame IP not in any known module. Following frames may be wrong.
03 0615f7a4 799dd087 0x628aa0c
04 0615f814 05cf69b7 mscorlib_79990000+0x4d087
05 0615f83c 05cf6974 0x5cf69b7
06 00000000 00000000 0x5cf6974


Thread ID: 25
System Thread ID: bc4
Kernel Time: 0:2:52.750
User Time: 0:7:14.953
Thread Type: Other
# ChildEBP RetAddr
00 0619f4c0 7c821204 ntdll!KiFastSystemCallRet
01 0619f4c4 77e6c401 ntdll!ZwCreateFile+0xc
02 0619f560 77c11b6b kernel32!CreateFileW+0x377
03 0619f594 77c11afa GDI32!pmfAllocMF+0xa2
04 0619f5c0 4ddc905a GDI32!GetEnhMetaFileW+0x17
05 0619f6f4 4ddc1f30 gdiplus!GpMetafile::GpMetafile+0x177
06 0619f708 4dd948d1 gdiplus!GpImage::LoadImageW+0x20
07 0619f71c 0628b775 gdiplus!GdipLoadImageFromFile+0x24
WARNING: Frame IP not in any known module. Following frames may be wrong.
08 0619f770 07754650 0x628b775
09 0619f7f8 0bbe0425 0x7754650
0a 0619f84c 0775407c 0xbbe0425
0b 0619f8a0 06e69cca 0x775407c
0c 0619f8ec 06e69b93 0x6e69cca
0d 0619f944 06b66458 0x6e69b93
0e 0619f9d4 7923c206 0x6b66458
0f 0619fa14 791cc3c8 mscorsvr+0x8c206
10 0619fa5c 7923c1c3 mscorsvr+0x1c3c8
11 0619fac4 0628a0bd mscorsvr+0x8c1c3
12 0619fba8 05d6b030 0x628a0bd
13 05d6b030 00000000 0x5d6b030
GetContextState failed, 0x8007001F
GetContextState failed, 0x8007001F
GetContextState failed, 0x8007001F

Thread ID: 26
System Thread ID: 0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
GetContextState failed, 0x8007001F


Please help me !
Thanks for reeply